Ohio stands alone in allowing broad access to facial recognition system without oversight

Sep. 22, 2013

Written by

and Chrissie Thompson

How useful is facial recognition software?

The debate over whether to restrict access to facial recognition software in Ohio calls into question the technology’s usefulness: Can officers really benefit from doing a facial recognition search? Whether a search produces a hit depends largely on photo quality. Straight-on, high-resolution photos work the best, and that means security-camera stills, which are often shot from above and are often grainy, don’t often return accurate results. Photos in which people are wearing glasses or smiling also aren’t as easy to match. When Enquirer columnist Krista Ramsey tested the technology last month, sitting for a photo at the attorney general’s office and then running it through the system, the software couldn’t match the snapshot with her license photo. The technology has not revolutionized crime fighting in South Dakota, where officers must request access to the license bureau’s facial recognition system. In more than three years, the bureau has received only a half-dozen requests from officers, said Cynthia Gerber, program director of driver licensing. That’s because police officers have used license photos and security images to track alleged criminals since well before facial recognition software. At the first meeting of the advisory board reviewing the new system, Tom Stickrath, head of Ohio’s Bureau of Criminal Investigation, described a 2010 case in Knox County. Four people were missing from a bloody crime scene. But officers found a Wal-Mart bag of recent purchases, and used Wal-Mart’s security video to find the man who made the purchases. The video also showed him getting into his car. Officers then searched the law enforcement database for cars like his registered in Knox County and found their man. Had officers had access to facial recognition technology in 2010, they might have been able to use the technology to identify the man in the Wal-Mart video, Stickrath said. “Having said that, the search was relatively quick,” he said.

How federal agents search images

In the past decade, the Federal Bureau of Investigation has launched two pilot programs using facial recognition software to search driver’s license images and criminal mugshots. “Project Facemask” was initiated in 2007 between the FBI and North Carolina Department of Motor Vehicles to locate fugitives and missing people using facial recognition technology. In 2009, the program helped to link a fake name on a North Carolina driver’s license to a California double-homicide suspect, garnering national attention. From the pilot, the FBI created the Facial Analysis Comparison and Evaluation Unit, which expanded the program to 11 states, allowing federal authorities access to state motor vehicle records, Jerome Pender, deputy assistant director of the Criminal Justice Services Division told U.S. senators at a subcommittee last year. Ohio does not participate it that pilot, but does have a memorandum of understanding for a second program, which uses facial recognition software on criminal mugshots, according to the Ohio Attorney General’s Office. The FBI, which launched the program in 2012, has kept a repository of 12.8 million mugshot images for years, but searching through them with facial recognition software is new, Stephen Fischer, FBI chief of multimedia productions, said in an e-mail.

More

ADVERTISEMENT

Ohio’s new facial recognition system has fewer restrictions for its use than similar systems in any other state in the U.S., an Enquirer/Gannett Ohio investigation has found.

No other such system in the nation allows 30,000 police officers and court employees to search driver’s license images, without audits or oversight.

When a previous Enquirer investigation revealed Attorney General Mike DeWine’s office had launched facial recognition technology in June, without telling the public and without first reviewing security protocols, DeWine said the technology was in use by law enforcement in more than half of all states.

But use of the technology is far less ubiquitous than DeWine’s comments would imply. In Kentucky, for instance, 34 people can run a facial recognition search — three in the license bureau and 31 in the state police. In Ohio, 30,000 police and court employees can run a search – access that’s unmatched anywhere else in the country.

CentralOhio.com and the Enquirer called officials in all 49 other states and Washington, D.C., to gather details on how they use facial recognition software.

Thirty-eight states, including Ohio, along with Washington, D.C., have launched facial recognition systems that match a photograph with a driver’s license picture. But in nearly every state, those systems were launched and controlled by the driver’s license bureau, which uses the system to prevent duplicate or fraudulent identification cards.

In Ohio, the attorney general’s office launched the system , allowing it to become by far the most permissive system in the nation.

Balancing privacy and safety

Twelve states, including Michigan, do not use facial recognition software at all – whether for privacy concerns in the “Live Free or Die” state of New Hampshire or ignorance in Wyoming, where officials didn’t realize such technology existed outside of science fiction movies.

Maine law prohibits use of facial recognition software by any state agency, including driver’s license personnel, its Secretary of State Matthew Dunlap said.

“We believe that people have a fundamental right to privacy,” he said.

And 12 states have facial recognition systems, but don’t allow law enforcement personnel to benefit from the technology in any way. In Wisconsin, state law prohibits law enforcement access to the system, said Debbie Kraemer, supervisor of the state’s division of motor vehicles.

“When we went to digital photos, there was a great deal of concern about misuse and making sure it was monitored,” Kraemer said.

Of the 26 states, plus Washington, D.C., that do allow law enforcement to use facial recognition systems, all have more limitations on access than Ohio. In Pennsylvania, access is limited to a group of about 500 people. In Illinois, Texas and South Carolina, all officers with access belong to a version of the state police. In Nebraska, state police and departments in Lincoln and Omaha have access.

In 15 states, including Indiana, plus Washington D.C., law enforcement officers must ask license bureau personnel to run a search for them.

The remainingstates allow just a few statewide criminal investigators to handle searches for the rest of the state’s law enforcement officers. Restricting access reduces the risk of abuse or misuse, said Dwayne Baird, spokesman for Utah’s Department of Public Safety, where about a dozen people have access to the state’s facial recognition system.

“I don’t know that there’s an audit, but these are very professional people,” Baird said. “It’s not like we have two or three thousand people accessing the system.”

Try 30,000. That’s the number of people who have access to facial recognition software in Ohio, where the attorney general’s office currently does not audit to check for misuse. In the system’s first three months of use, 330 local, state and federal agencies had performed a total of 3,179 facial recognition searches. Ohio’s 30,000 users include local and state police, sheriffs, civilian employees of police departments, court employees – even out-of-state and federal law enforcement agencies.

For instance, 165 members of Pennsylvania’s state police have access to Ohio’s law enforcement database and its facial recognition search. The Pennsylvania officers alone number more than the people who have access to facial recognition in most other states.

When Ohio launched its facial recognition system in June, it hadn’t sought comprehensive information about use of the technology around the country, said Tom Stickrath, head of the Bureau of Criminal Investigation, which DeWine oversees.

Still, “some of our discussions with other states had indicated it was a good tool for the broader law enforcement,” Stickrath said.

The facial recognition tool is a feature of the Ohio Law Enforcement Gateway, or OHLEG, a source for driver’s license information and photos, license plate numbers, concealed-carry permits, sex offenders, pharmacy thefts and more. Ohio officials believe no other state has a one-stop system like it, and its existence may be one reason Ohio could so easily give facial recognition access to so many people, Stickrath said.

But most states said they limited access so they could more closely monitor the system, prevent misuse and protect privacy. “That’s the main thing (for security): that it’s only our own people who can access it directly,” said Kevin Malone, spokesman for the license bureau in Nevada, where a small group of investigators run searches for police across the state.

Ohio’s system is unique in its use by court employees, who lack the training of police officers. That particularly worried members of the advisory board appointed by DeWine to review Ohio’s facial recognition system and its law enforcement database.

“All of us who work in courts know employees who, there’s a new guy they’re dating, so they want to run him through the system to see if he’s got a record,” advisory board co-chair Yvette McGee Brown, a former Ohio Supreme Court justice, told the board this month.

The group is looking into limiting access to facial recognition technology to law enforcement personnel only. Even then, Ohio’s system would still have fewer restrictions for its use than any other system in the U.S.: It would still be open to any small-town police officer or sheriff, essentially any time he or she had Internet or smartphone access.

At the advisory board meeting on Friday, several OHLEG users said they had never run a facial recognition search.

“For 13 years, I’ve been a patrol officer, and I have no idea what I would use facial recognition for,” Madison County Deputy CQTim Winebrenner said.

Still, for McGee Brown, allowing all Ohio law enforcement officers to access the system is important, even if it means Ohio has thousands more who can run a search than other states.

“If something horrific happened, and it’s in the middle of the night, and you can’t get to whomever has access to facial recognition ...

“We’ve got to be careful,” she said. “These are quick-moving times we live in. And when things go wrong, you’ve got to move fast.”

8,400 possibilities for abuse?

Security concerns for the state’s law enforcement database range from personal misuse, as in McGee Brown’s comment about court employees, to systemic abuse. For example, in a mushrooming scandal in Minnesota, police officers across the state are being accused of having performed at least 8,400 inappropriate searches in a database of driver and license information, according to the Minneapolis Star Tribune. One TV news anchor said officers illegally searched her driver’s license about 1,380 times.

To detect that kind of misuse in Ohio, someone would have to suspect it was going on. Once an accusation is made, DeWine’s office can see who has accessed records about a person. Misuse can result in losing access to OHLEG, getting fired or being prosecuted for a fifth-degree felony.

But since the database isn’t audited, officials have no way to catch people who are breaking the rules and are escaping notice or suspicion. So the advisory board is considering whether to recommend that the attorney general’s office audit to catch misuse.

Several other states audit users of their facial recognition systems, The Enquirer found. The attorney general’s office has reached out to the Association of State Criminal Investigative Agencies to try to find out how other states audit their systems, although Ohio’s audit might be more complicated, since the state has so many users. OHLEG users at the advisory board meeting Friday recommended random audits or having individual police departments review automated audits to help increase security without burdening small departments.

“It’s a startling finding to see that every other state has been far more careful than Ohio,” said David Pepper, DeWine’s 2014 opponent and a former Cincinnati councilman and Hamilton County commissioner. “ Our only hope is that the committee take their mission seriously, uncover the best practices and insist that they be adopted.”

Civil liberties groups are also worried about how the government could misuse the facial recognition system, eventually linking it to security cameras to identify people in real-time as they enter businesses or walk down streets. Think they’re conspiracy theorists? Just look at the National Security Agency’s secret spying programs for proof that government doesn’t hold back when it comes to invading privacy, they say.

That’s a main reason Gov. John Kasich has said he doesn’t want Ohio’s Bureau of Motor Vehicles to use the facial recognition technology as it issues licenses. While most states with facial recognition run all of their license photos through the system, often an overnight and automated search designed to catch license fraud, Ohio won’t do that until the advisory board addresses security concerns. Even then, BMV spokesman Joe Andrews said, the license bureau plans to get approval from the General Assembly first.

Ohio law requires the BMV to give law enforcement access to driver’s license photos. Before the facial recognition system launched, that meant police could view a license photo after searching characteristics about a person, including name, address, license plate number or even age, gender and height.

Now, with facial recognition, an officer need only have a clear snapshot of a person — a mug shot, a Facebook profile photo, a photo snapped on the street or, in some cases, a security camera image — to view her license photo and identify her. The facial recognition software merely provides a more efficient way of searching the license photos, DeWine has said.

Advocates looking for change to Ohio’s law will have to look past DeWine’s advisory board to the Ohio Legislature, which so far is standing by in the facial recognition debate.

“Because of this, more people having access (than in other states), we’re going to catch more criminals than any other state,” said Rep. Rex Damschroder, R-Fremont, who chairs the House committee on public safety. “I certainly think we could review (the facial recognition system). I don’t personally see the need. If it’s demanded by the public, we’ll gladly do it.”

Even the ranking Democrat on the committee, Dale Mallory, of Cincinnati, doesn’t see the need to call DeWine, a Republican, in for hearings, at least not yet.

“As a homeland security tool, I think it can be useful,” Mallory said. “It’s kind of out there now, and I’m just curious to see how they reel it back in and deal with it. I think we should give the implementers a chance to explain it.” ■